CVE-2018-1128: debian debian_linux Authentication Bypass by Capture-replay
Vulnerability summary
CVE-2018-1128 is a high (CVSS 7.5) Authentication Bypass by Capture-replay vulnerability in debian debian_linux. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities.
Not severe (CVSS 7.5, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 21 · Related 14Timeline
- 10-07-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat8 products
- ceph≥ 10.2.0, ≤ 13.2.1
- ceph_storage3
- ceph_storage_mon2 | 3
- ceph_storage_osd2 | 3
- enterprise_linuxEOL7.0
Debian3 products
- ceph< 12.2.8+dfsg1-1
- linux< 4.19.9-1
- debian_linuxEOL8.0 | 9.0
Opensuse1 product
- leapEOL15.0
Red hat, inc.1 product
- cephAll versions in branches master, mimic, luminous and jewel
Ubuntu1 product
- cephAll versions (No fix recorded)
5 vendors · 14 products
References
15 links- github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468X Refsource CONFIRMPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1575866X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory